I've got an answer to this problem for people coming here with this issue who aren't using Active Directory (meaning that it can't be the cause).
For me the problem was my Dropbox was struggling with broken symlinks inside my Dropbox folder. I had about 20-25 of these broken symlinks. You can see if this is the problem for you by whether the problem goes ...
This is how I usually repair a broken LDAP/OD
1. check if this is the problem
sudo /usr/libexec/slapd -Tt*
You might get:
bdb_db_open: database "cn=authdata": db_open(/var/db/openldap/authdata/id2entry.bdb) failed: Invalid argument (22).
2. Stop LDAP on OD Master
sudo launchctl unload /System/Library/LaunchDaemons/org.openldap.slapd.plist
3. Repair ...
By default Double Commander is programmed to open with two Tabs each set to the current location of the Double Commander.app application bundle. If one then changes to a different location other then the default on one of the Tabs and then closes Double Commander and reopens it, it opens to the last location before being closed.
Here's a way to open Double ...
OS X: If the opendirectoryd process CPU utilization is high after updating to OS X v10.9.5
You might see an increase in CPU utilization of the opendirectoryd process on systems bound to Active Directory that are updated to OS X v10.9.5.
After updating to OS X v10.9.5, Activity Monitor might report high CPU
utilization for the process "opendirectoryd&...
Hope this isn't too late, or that at least it is useful for others.
I tried http://support.apple.com/kb/ht1194 several times to no avail. I was simply unable to authenticate with the diradmin account.
An Apple support person recommended:
Archive the OD from the Server.app → OD panel → action menu → Archive Open Directory Master…
Select the server in the ...
Anything running it should be within this scope.
dec_dlm - DEC DLMIANA - ipcserver
Mac OS X RPC-based services. Used by NetInfo, for example.
Appledec_dlm - Directory Service Proxy (DSProxy) (Unregistered Use). DirectoryService, Open Directory Assistant, Workgroup Manager. Note: This port is registered to DEC DLM.
The issue is the ACLs are not set up in the local directory for SMB and AFP. These used to be created in the older Server apps that had File Sharing in them. I've written an AppleScript that takes care of all this. It creates the appropriate ACL groups in the directory (/Local/Default/Groups/com.apple.access_smb and com.apple.access_afp), then adds all the ...
This worked for me at 10.10 Yosemite:
sudo ldapsearch -LLL -x -H ldap://127.0.0.1 -s base namingContexts
dn: namingContexts: dc=XXX-Produktion,dc=local
Put your dc= ,dc= into this:
sudo ldappasswd -x -H ldapi://%2Fvar%2Frun%2Fldapi -S uid=diradmin,cn=users,dc=XXX-Produktion,dc=local
You need to import the cert via Server.app; that'll add it to the System keychain and several other locations that allow non-keychain-aware services to use it. I'm not sure why it'd be hanging, but I can think of a few things to try:
If it's not a self-signed certificate, you probably need to import the appropriate intermediate certificate(s) by dragging ...
Ctrl click or Right click on the item then select Get Info from the popup menu (or else select the item and select Get Info from the File Menu). When Get Info window is open you can select what app to open it with and choose to open all similiar documents with the new app as well.
You can use the Directory Editor that is part of Directory Utility (in /System/Library/CoreServices) to add a new automount record. I recommend using the existing record as a template for your new mounts.
The image above references the Mounts container in the /Local/Default node. You would obviously want to choose the LDAP node that represents your Open ...
There is a daemon that backups the directory /private/var/db/dslocal nightly. If the backup hasn't occurred since the removal of the user then the info could be restored. The archive is /private/var/db/dslocal-backup.xar.
An alternate solution for "system" users and groups:
Rebuild the corresponding user and group plist's from /private/etc/passwd and /...
Port 625 is used by the opendirectoryd daemon. This is the daemon that is in charge of talking to the directory system. The most common two purposes you might use it's services are for authentication, it looks up accounts and passwords, and for service discovery, it keeps an eye out for servers and such like on the network.
Disabling it would not be a good ...
Try using pwpolicy
pwpolicy -n /Local/Default -setpolicy "minutesUntilFailedLoginReset=3"
This will set the policy of a failed login for a local account to 3 mins between logins.
pwpolicy -n /Local/Default -setpolicy "maxFailedLoginAttempts=1"
This will set the maximum number of failed login attempts to just 1 (IMO this is way to restrictive to account ...
I see it's been a while since the question was raised, but I came across the same recently and fortunately found help on the MacAdmins Slack: the cause is that a GUID attribute is missing from the OpenLDAP user record.
In Apple directory services, the attribute is called GeneratedUID.
The slight difficulty is that the RFC2307 mapping in the LDAP ...
Click on the Path button, which shows all the levels up to the folder.
Click on a folder in this list to jump to it. The list is always reverse hierarchy so the folder containing the current folder will be one down from the top of the list.
The shortcut to go up a level is ⌘↑.
At long last, yes you can set up management for zero touch deployment through a couple avenues.
Use an Apple Service called Device Enrollment Program which is now part of the Apple Business Manager service / web app. https://business.apple.com
Use a product to leverage the login process and install a tool like Jamf Connect which lets you run scripts and ...
The answer was here: https://support.apple.com/en-us/HT204021
If you use Directory Utility on the client to have an authenticated binding between the client machine and the server Open Directory, you can mount SMB shares.
There are other workarounds which are either less secure or have poor performance on writing. See the linked support article.
NB: the account home folder at /var/teamsserver is misspelled by apple. Check it out carefully - it only has one "s". Create a properly spelled folder in var, then run chown to make sure it's owned by teamsserver and you'll be good to go.
Server data app on OS X is highly standards compliant. LDAP is industry-standard (but it's not active directory), Mail is IMAP, CardDAV, WebDAV and CalDAV. All are quite standard and ubiquitous. Filesharing uses SMB3.
Unless you have highly specific/rigid client requirements or are wedded to certain client apps, you should be able to make productive use ...
In order to change a user's expiration, in the Server.app you need to go to "Users", then make sure that "Local Network Users" are chosen (using "All Users" keeps that option greyed out). Then highlight that user in question and from the cogwheel button below the list choose "Edit Password Policy".
There you will find all the "missing options" like ...
The OD server on 10.10 uses the identity certificate pointed to by the "MACHINE_IDENTITY" identity preference. Using Keychain Access or the security command line tool change the identity preference to point to your new CA signed cert.
Okay I've managed a solution. Note this only works if the open directory hasn't been corrupted like ours was, you'll need to chown the home directory again after a rebind. Here's the steps:
Login to the machine as the network user
Go to https://your.server.com/mydevices and un-enroll
Log in as local admin user, not network user
Delete all keychain ...
I had the same problem initially too. But for many months now, though, Open Directory has been working as expected and serves our many users' credentials reliably.
It was only after the following that Open Directory settled down:
I was 100% sure that the OS X Server's DNS and reverse DNS was consistent, as viewed from within and without our network, and
You can integrate Active Directory with Open Directory in Mavericks, but it's a much different process then before. You have to give the AD user access to the services you want them to use before adding them to a group. (For instance FileSharing) If you don't you will get some weird errors, especially with Window's users. Once you give them access, then you ...
I would like to thank iLikeStrongJava for posting this issue and suggested solution. We too have been having this problem with both Mavericks and Yosemite. With regards to not seeing this issue posted in the Apple Discussion forums I think the reason for that is that there are so many overlapping network home directory problems that it is often hard to ...
I broke down and called Apple Care tonight and got quickly directed over to the Server team. Shocking to me, but the tech was able to reproduce my issue! This surprised me because no one in the Apple Discussion groups (or really elsewhere) has mentioned the problem. So the tech is elevating the issue and hopefully we'll see a bug fix soon. I haven't tested ...
The following were the steps I took to resolve this issue:
Reboot the server in safe mode (hold down shift key whilst restarting)
Let it idle for a while (apparently it is cleaning out caches in this mode)
Stop the existing slapd server
sudo launchctl unload /System/Library/LaunchDaemons/org.openldap.slapd.plist
Set the correct certificate GUID in the ...
It seems difficult to believe that it is as you suspect, that something that a client did has locked you out of control of your own server.
Check permissions! Break out the Terminal and attempt to discover where the critical configuration files are for Open Directory, and make sure your permissions ( ls -l ) haven't been "bonked" <-- (sorry for the ...